Overview

overview

10

Static

static

10

5f417d65d8...1c.exe

windows7-x64

9

5f417d65d8...1c.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 21:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5f417d65d8a0694f2a8c5b2100b18c9b6804226f30204afcda8e2e15f4fea31c.exe

  • Size

    1.6MB

  • MD5

    1a42555df248abdc20875e66a6541b4b

  • SHA1

    4212ae77427fc00772179575bf9541ddd1a48df4

  • SHA256

    5f417d65d8a0694f2a8c5b2100b18c9b6804226f30204afcda8e2e15f4fea31c

  • SHA512

    965cfeebf2e05ee371171e5a62d8bae116a95919c7e02d20fe3515cd355baf2ad50a35bfb66d1b8788d88e5b839d58983c93003a5276068b71e79889a0d01f92

  • SSDEEP

    49152:BEbVSR5L8v5m0Cf6Se3NQHIYR961xe7NUsL:WbVkkZSONM96kNTL

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f417d65d8a0694f2a8c5b2100b18c9b6804226f30204afcda8e2e15f4fea31c.exe
    "C:\Users\Admin\AppData\Local\Temp\5f417d65d8a0694f2a8c5b2100b18c9b6804226f30204afcda8e2e15f4fea31c.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Users\Admin\AppData\Local\Temp\5f417d65d8a0694f2a8c5b2100b18c9b6804226f30204afcda8e2e15f4fea31c.exe
      "C:\Users\Admin\AppData\Local\Temp\5f417d65d8a0694f2a8c5b2100b18c9b6804226f30204afcda8e2e15f4fea31c.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Users\Admin\AppData\Local\Temp\5f417d65d8a0694f2a8c5b2100b18c9b6804226f30204afcda8e2e15f4fea31c.exe
        "C:\Users\Admin\AppData\Local\Temp\5f417d65d8a0694f2a8c5b2100b18c9b6804226f30204afcda8e2e15f4fea31c.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 372
      2⤵
      • Program crash
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\italian kicking sperm uncut .mpeg.exe
    Filesize

    971KB

    MD5

    dec7436454fc1f6122592a496b88da03

    SHA1

    1e4d43a14686d52f51b3834b6df0b8cc2ed95328

    SHA256

    283f1a0ab9f2be3500922314b229a48a8f81f2cdfd1e82755ba9d44bf55bb482

    SHA512

    61dcfb1b4b56f16e12d351528ce9a748883f40f1c56b656c8af3e8ef85a66b021c045b880e97c60390dd0fc942accd7a1a19f6939b8b6b51bcffabda105c02b6

    Download Submit

  • C:\debug.txt
    Filesize

    183B

    MD5

    c1e7149376468e6ca933f2dedcf590ef

    SHA1

    00deebc0345dc09d555596ee9fc2baffb9a5c980

    SHA256

    e2940be56f386e7b2a0b1b8814f5efc5fa6b76edec8fe9ee95ab83b3020726e2

    SHA512

    b564e93f9327e9c2cdad619b3359aa2d3ac7e1ffa441f539a63eb8ac0d374216769da38f69fe2bc6253501598778995c15ca898dfb2d20fba2a12362431db5ed

    Download Submit